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Abstract — Recently, there has been immense interest in using 
unmanned aerial vehicles (UAVs) for civilian operations such 
as package delivery, firefighting, and fast disaster response. 
As a result, UAV traffic management systems are needed to 
support potentiaily thousands of UAVs flying simultaneously 
in the airspace, in order to ensure their liveness and safety 
requirements are met. Hamilton-Jacobi (HJ) reachability is a 
powerful framework for providing conditions under which these 
requirements can be met, and for synthesizing the optimal 
controller for meeting them. However, due to the curse of 
dimensionality, HJ reachability is only tractable for a small 
number of vehicles if their set of maneuvers is unrestricted. 
In this paper, we define a pfatoon to be a group of UAVs 
in a single-fife formation. We model each vehicle as a hybrid 
system with modes corresponding to its role in the platoon, and 
specify the set of allowed maneuvers in each mode to make 
the analysis tractable. We propose several liveness controllers 
based on HJ reachability, and wrap a safety controller, also 
based on HJ reachability, around the liveness controllers. For 
a single altitude range, our approach guarantees safety for one 
safety breach; in the unlikely event of multiple safety breaches, 
safety can be guaranteed over multiple altitude ranges. We 
demonstrate the satisfaction of liveness and safety requirements 
through simulations of three common scenarios. 

I. Introduction 

Unmanned aerial vehicle (UAV) systems have in the past 
been mainly used for military operations [1], Recently, 
however, there has been an immense surge of interest in 
using UAVs for civil applications through projects such 
as Amazon Prime Air and Google Project Wing [2], [3], 
[4], As a result, government agencies such as the Federal 
Aviation Administration (FAA) and National Aeronautics 
and Space Administration (NASA) of the United States are 
also investigating air traffic control for autonomous vehicles 
to prevent collisions among potentially numerous UAVs [5]. 

Optimal control and game theory are powerful tools for 
providing liveness and safety guarantees to controlled dy¬ 
namical systems, and various formulations [6], [7], [8] have 
been successfully used to analyze problems involving a small 
number of vehicles [9], [10], [11]. These formulations are 
based on Hamilton-Jacobi (HJ) reachability, which computes 
the backwards reachable set, defined as the set of states from 
which a system is guaranteed to have a control strategy 
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to reach a target set of states. Reachability is powerful 
because it can be used for synthesizing both controllers that 
steer the system towards a goal (liveness controllers), and 
controllers that steer the system away from danger (safety 
controllers). Furthermore, HJ formulations are flexible in 
terms of system dynamics, enabling the analysis of nonlinear 
systems. The power and success of HJ reachability analysis 
in previous applications is evident, especially since numerical 
tools are readily available to solve the associated HJ Par¬ 
tial Differential Equation (PDE) [12], [13], [14], However, 
the computation is done on a grid, making the problem 
complexity scale exponentially with the number of states, 
and therefore with the number of vehicles. This makes the 
computation intractable for large numbers of vehicles. 

A considerable body of work has been done on the 
platooning of vehicles [15]. For example, [16] investigated 
the feasibility of vehicle platooning in terms of tracking 
errors in the presence of disturbances, taking into account 
complex nonlinear dynamics of each vehicle. [17] explored 
several control techniques for performing various platoon 
maneuvers such as lane changes, merge procedures, and 
split procedures. In [18], the authors modeled vehicles in 
platoons as hybrid systems, synthesized safety controllers, 
and analyzed throughput. Finally, reachability analysis was 
used in [19] to analyze a platoon of two trucks in order 
to reduce drag by minimizing the following distance while 
maintaining collision avoidance safety guarantees. 

Previous analyses of a large number of vehicles typically 
do not provide liveness and safety guarantees to the extent 
that HJ reachability does; however, HJ reachability typi¬ 
cally cannot be used to tractably analyze a large number 
of vehicles. In this paper, we attempt to reconciliate this 
trade-off by assuming a single-file platoon, which provides 
structure that allows pairwise safety guarantees from HJ 
reachability to translate to safety guarantees for the whole 
platoon. We first propose a hybrid systems model of UAVs 
in platoons to capture this structure. Then, we show how HJ 
reachability can be used to synthesize liveness controllers 
that enable vehicles to reach a set of desired states, and 
wrap safety controllers around the liveness controllers to 
prevent dangerous configurations such as collisions. Finally, 
we show simulation results of quadrotors forming a platoon, 
a platoon responding to a malfunctioning member, and a 
platoon responding to an outside intruder to illustrate the 
behavior of vehicles in these scenarios and demonstrate the 
guarantees provided by HJ reachability. 



II. Problem Formulation 
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A. Vehicle Dynamics 

Consider a UAV whose dynamics are given by 

x = f(x,u ) (1) 

where x £ represents the state, and u £ K ra “ represents 
the control action. In this paper, we will assume that each 
vehicle has a simple kinematics model of a quadrotor: 

Px = V x , Py = v y ^ 

V x = ttzj Vy — tty, \Vy\ ^ U max 

where the state (at a fixed altitude) x = [px,v x ,p y ,v y ) £ 
R' 1 represents the quadrotor’s position in the x direction, its 
velocity in the x direction, and its position and velocity in the 
y direction, respectively. For convenience, we will denote the 
position and velocity p = (p x ,p y ), v = (v x , v y ), respectively. 
We will consider a group of N quadrotors Qi,i = 1 ...,7V. 

In general, the problem of collision avoidance among N 
vehicles cannot be tractably solved using traditional dynamic 
programming approaches because the computation complex¬ 
ity of these approaches scales exponentially with the number 
of vehicles. Thus, in our present work, we will consider the 
situation where N quadrotors form a platoon. The structure 
imposed by the platoon enables us to analyze the liveness 
and safety of the quadrotors in a tractable manner. 

B. Relative Dynamics and Augmented Relative Dynamics 

Besides we will also consider the relative dynamics 
between two quadrotors (j,. Qj. These dynamics can be 
obtained by defining the relative variables 


Px,r — Px,i Px,ji Pyx — Py,i Py,j 

V x ,r = V x ^i V x j : Vy^r ~ V yi i Vy.j 

We treat Qi as Player 1, the evader who wishes to avoid 
collision, and we treat Qj as Player 2, the pursuer, or 
disturbance, that wishes to cause a collision. In terms of the 
relative variables given in ([3]), we have 

Px,r — *' 21 , 7*5 Py,r — ^y,r 

vx,r — ^x,i 'U j x,ji Vy,r — ^y-,3 

We also augment ([3} with the velocity of Qi to impose a 
velocity limit when performing the avoidance maneuver. 


Px,r ^ 2 ?, 7*5 

Py,r — '^y,i" 

Vx,r — ^x,i ^x,j 5 

Vy,r — u y,i 

^x,i — 'U'Xiii 

Vy,i — u y,i 


C. Quadrotors in a Platoon 

We consider a platoon of quadrotors to be a group of M 
quadrotors Qp 1 ,..■, Qp m in a single-file formation. Not all 
of the N quadrotors need to be in a platoon: {Pj }jf =1 C 
WlLi- Qpi i s ^e leader of the platoon, and Qp 2 ,..., Qp M 
are the followers. We will assume that the quadrotors in a 
platoon travel along an air highway, which is defined by 
as a path inside a pre-defined altitude range. The quadrotors 
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Fig. 1: Hybrid modes for vehicles in platoons. 


maintain a separation distance of b. In order to allow for close 
proximity of the quadrotors and the ability to resolve multiple 
simultaneous safety breaches, we assume that in the event of 
a malfunction, a quadrotor will be able to exit the altitude 
range of the highway within a duration of t internal = 1-5. 
Such a requirement may be implemented practically as an 
emergency landing procedure to which the quadrotors revert 
when a malfunction is detected. Each quadrotor must be 
capable of performing a number of essential cooperative 
maneuvers. In this paper, we consider the following: 

• safely merging onto an air highway; 

• safely joining a platoon; 

• reacting to a malfunctioning vehicle in the platoon; 

• reacting to an intruder vehicle; 

• following the highway, a curve defined in space at 
constant altitude, at a specified speed; 

• maintaining a constant relative position and velocity 
with the leader of a platoon. 

D. Vehicles as Hybrid Systems 

A UAV in general may be in a number of modes of 
operations, depending on whether it is part of a platoon, and 
in the affirmative case, whether it is a leader or a follower. 
Therefore, it is natural to model vehicles as hybrid systems 
[18], [20], In this paper, we restrict the available maneuvers 
of each quadrotor depending on the mode. We assume that 
each quadrotor in the airspace has the following modes: 

• Free: Vehicle not in a platoon. Available maneuvers: 
merge onto a highway, join a platoon on a highway. 

• Leader: Leader of platoon (could be by itself). Available 
maneuvers: travel along the highway at a pre-specified 
speed, merge current platoon with a platoon in front, 
leave the highway. 

• Lollower: Vehicle following the platoon leader. Avail¬ 
able maneuvers: follow a platoon, create a new platoon. 

• Laulty: Malfunctioned vehicle in a platoon: reverts to 
default behavior and descends after a duration of t internal- 

The available maneuvers and associated mode transitions 
are shown in Ligure [T| 








E. Objectives 

Using the previously-mentioned modeling assumptions, 
we would like to address the following questions: 

1) How can vehicles effectively form platoons? 

2) How can the safety of the vehicles be ensured during 
normal operation and when there is a malfunctioning 
vehicle within the platoon? 

3) How can the platoon respond to intruders such as 
unresponsive UAVs, birds, or other aerial objects? 

The answers to these questions can be broken down into 


the maneuvers listed in Section II-C In general, the control 
strategies of each vehicle have a liveness component, which 
specifies a set of states towards which the vehicle aims to 
reach, and a safety component, which specifies a set of states 
that it must avoid. In this paper, we address both the liveness 
and safety component using reachability analysis. 


of the following terminal value Hamilton-Jacobi-Isaacs (HJI) 
PDE: 

D t V + min{0, max min D X V ■ /(at, 111 , 112 )} = 0, 

UlGlti U 2 &A 2 (20) 

V(0, x ) = l(x) 

from which we obtain V(t) = {x £ R" | V(t,x) < 0}. 
From the solution V(t,x), we can also obtain the optimal 
controls for both players via the following: 


u\{t,x) = arg max min D x V(t,x) • /(at, iti, 112 ) 

ui^Ui U2EU2 

u* 2 (t,x) = arg min D x V(t,x) ■ f(x,u* 1 ,u 2 ) 

U 2 €U2 


( 11 ) 


In the special case where there is only one player (Player 
2 does not exist), we obtain an optimal control problem for 
a system with dynamics 


III. Hamilton-Jacobi Reachability 
A. General Framework 

Consider a differential game between two players de¬ 
scribed by the system 

x = f{x , Mi, U 2 ), for almost every t £ [—T, 0] (6) 

where x £ 1" is the system state, u\ £ U\ is the control 
of Player 1, and m 2 £ is the control of Player 2. We 

assume / : R ra x U\ x U 2 —> R n is uniformly continuous, 
bounded, and Lipschitz continuous in x for fixed U\,U2, and 
the control functions tti(-) £ £ U 2 are drawn from 

the set of measurable functions. Player 2 is allowed to use 
nonanticipative strategies [21], [22] 7, defined by 

7 £ T := {J\T : Ui —> U 2 | Ui(r) = Mi(r) 
for almost every r £ [£, s] => Af[ui](r) (7) 

= A/"[tii](r) for almost every r £ [ t , s]} 

In our differential game, the goal of Player 2 is to drive 
the system into some target set C, and the goal of Player 1 
is to drive the system away from it. The set C is represented 
as the zero sublevel set of a bounded, Lipschitz continuous 
function l : R™ —> R. We call ((•) the implicit surface 
function representing the set C = {x £ R" | l{x) < 0}. 

Given the dynamics and the target set C, we would 
like to compute the backwards reachable set, V(t): 

V(f) := {at G R" | 37 G T such that Vui(-) G Ui, 

(o) 

3s G [t, 0], £/(s; f, at, ui(-), 7 [ui](-)) G C} 

where £/ is the trajectory of the system satisfying initial 
conditions (f; at, f, tt]/-), m 2 (-)) = x and the following 
differential equation almost everywhere on [—f, 0]: 

= /(£/(s; at, f, Mi(-), U 2 {-)),U 1 (s), U 2 {s)) 

For this paper, we use the HI formulation in [7], which has 
shown that the backwards reachable set V(f) can be obtained 
as the zero sublevel set of the viscosity solution [23] V(t , x) 


x = f{x,u) 1 t £ [—T, 0],u £U. (12) 

The reachable set in this case would be given by the 
Hamilton-Iacobi-Bellman (HIB) PDE 

D t V(t, x) + min{0, min D X V(t , x) ■ /( x, u)} = 0 

U &A (13) 

V (0, x) = l(x) 

where the optimal control is given by 

u*(t,x) = arg min D x V{t, x) ■ f(x,u) (14) 

u£U 

For our application, we will use a several decoupled 
system models and utilize the decoupled HI formulation in 
[24], which enables real time 4D reachable set computations 
and tractable 6D reachable set computations. 

IV. Liveness Controllers 
A. Merging onto a Highway 

We model the merging of a vehicle onto an air highway as 
a path planning problem, where we specify a target position 
and velocity along the highway. Thus, a vehicle would aim 
to drive the system © to a state x H = (Px,v x ,p y ,v y ), or a 
small range of states defined by the set 

C H = {.t : | p x p x | < r Px ,\v x - v x \ < r„ x , 

\p y -Py\<r Py ,\vy-Vy\<r Vy }. 

In this reachability problem, Ch is the target set, repre¬ 
sented by the zero sublevel set of the function Ih(x), which 
specifies the terminal condition of the HIB PDE to be solved. 
The solution we obtain, Vn(t,x), is the implicit surface 
function representing the reachable set Vjj(f); Vh(—T,x ) < 
0, then, specifies the reachable set Vh(T), the set of states 
from which the system can be driven to the target Ch within 
a duration of T. This gives the algorithm for merging onto 
the highway: 

1) Move towards xh in a straight line until Vh (—T, x) < 
0. This simple controller is chosen heuristically. 

2) Apply the optimal control extracted from Vh{—T,x) 
according to until Ch is reached. 



V. Safety Controllers 


B. Merging into a Platoon 

We again pose the merging of a vehicle into a platoon 
on an air highway as a reachability problem. Here, we 
would like quadrotor Qi to merge onto the highway and 
follow another vehicle Qj in a platoon. Thus, we would 
like to drive the system given by 0 to a specific xp = 
{Px,r, v x , r ,Py tr , v y<r ), or a small range of relative states 
defined by the set 


Cp — ■ |Pa:,r Px,r\ ^ < Xv x l ( 16 ) 

\Py,r Pyx I — Tpy i \ V VX Xy j7 .| £ ^ v y\ 

The target set Cp is represented by the implicit surface 
function l P (x), which specifies the terminal condition of the 
HJI PDE ( [Tol l. The zero sublevel set of the solution to ( p~0[ , 
Vp(—T,x), gives us the set of relative states from which 
Qi can reach the target and join the platoon following Qj 
within a duration of T. We assume that Qj moves along the 
highway at constant speed, so that Uj (t) = 0. The following 
is a suitable algorithm for a vehicle merging onto a highway 
and joining a platoon to follow Qj: 

1) Move towards xp in a straight line until Vp(—T, x) < 

0. 

2) Apply the optimal control extracted from Vp(—T,x) 
according to GD until Cp is reached. 

C. Other Quadrotor Maneuvers 

For the simpler maneuvers of traveling along a highway 
and following a platoon, we resort to simpler controllers 
described below. 

1) Traveling along a highway: We use a model-predictive 
controller (MPC) for traveling along a highway at a pre¬ 
specified speed. Here, a leader quadrotor tracks a constant- 
altitude path, defined as a curve p(s) parametrized by 
s £ [0,1] in p = ( p x ,p y ) space (position space), while 
maintaining a velocity v(s) that corresponds to constant 
speed in the direction of the highway. 

2) Following a Platoon: Follower vehicles use a feedback 
control law tracking a nominal position and velocity in the 
platoon, with an additional feed-forward term given by the 
leader’s acceleration input. 

The i-th member of the platoon, Q />, is expected to track 
a relative position in the platoon r® = (r® , r®) with respect 
to the leader’s position pp 1 , and the leader’s velocity vp 1 at 
all times. The resulting control law has the form: 

u\t) = k p [p Pl (t)+r\f)-p l (f)]+k v [• v Pl (t)-v l (t)\+u Pl (t ) 

(17) 

for some k p , k v > 0. A simple rule for determining r®(f) in 
a single-file platoon is given for Qp i as: 

r 4 (i) =-(* - l)6 r ^ r (18) 

F-P1H2 

where b is the spacing between vehicles along the platoon, 
and || is the platoon leader’s direction of travel. 


A. Wrapping Reachability Around Existing Controllers 

A quadrotor can use a liveness controller when it is not in 
any danger of collision with other quadrotors or obstacles. 
If the quadrotor could potentially be involved in a collision 
within the next short period of time, it must switch to a 
safety controller. In this section, we will demonstrate how 
HI reachability can be used to both detect imminent danger 
and synthesize a controller that guarantees safety within a 
specified time horizon. For our safety analysis, we will use 
the model in ([5j. 

We begin by defining the target set Cs, which character¬ 
izes configurations in relative coordinates for which vehicles 
Qi, Qj are considered to be in collision: 


Cs — {x : |px,r 1 1 |Py,r | < d V | V x ,i \ A t f max V \Vy^i \ f X max } 

(19) 

With this definition, Qi is considered to be unsafe if Qi 
and Qj are within a distance d in both x and y directions 
simultaneously, or if Qi has exceeded some maximum speed 
u m ax in either x or y direction. For illustration purposes, we 
choose d = 2 meters, and u max = 5 m/s. 

We can now define the implicit surface function ls(x) 
corresponding to Cs, and solve the HJI PDE ( |T()| > using ls(x) 
as the terminal condition. As before, the zero sublevel set of 
the solution Vs(t, x) specifies the reachable set Vg{t), which 
characterizes the states in the augmented relative coordinates, 
as defined in <0, from which Qi cannot avoid Cs for a 
time period of t, if Qj uses the worst case control. To avoid 
collisions, Qi must apply the safety controller according to 
on the boundary of the reachable set in order to avoid 
going into the reachable set. The following algorithm wraps 
our safety controller around liveness controllers: 


1) 


For a specified time horizon t, evaluate Vg(— t, x, xf) 
for all j £ Q(i). 

Q(i) is the set of quadrotors with which quadrotor i 


checks safety against. We discuss Q(i ) in Section V-B 


2) Use the safety or liveness controller depending on the 
values Vs{-t,Xi - Xj), j £ Q(i ): 

If 3j £ Q{i),Vs{—t, Xi — Xj) < 0, then Qi, Qj are in 
potential conflict, and Qi must use a safety controller; 
otherwise Qi uses a liveness controller. 


B. Platoon Safety Guarantees 

Under normal operations in a single platoon, each follower 
quadrotor Q ,i > 1 checks whether it is in the safety 
reachable set with respect to Qp i _ 1 and Qp i+1 . So Q(i ) = 
{Pi+^Pi-i} for i = P 2 ,...,P N _ 1 . Assuming there are no 
nearby quadrotors outside of the platoon, the platoon leader 
Qp 1 checks safety against Qp 2 , and the platoon trailer Qp N 
checks safety against Qp N _ 1 . So Q(Pi) = {P 2 }, Q(Pn ) = 
{P/v_i}. No pair of quadrotors should be in an unsafe 
configuration if the liveness controllers are well-designed. 
Occasionally, a quadrotor Qk may behave unexpectedly due 
to faults, which may lead to an unsafe configuration. 





With our choice of Q(i ) and the assumption that the 
platoon is in a single-file formation, some quadrotor Q, 
would get into an unsafe configuration with Qk, where Qk 
is likely to be the quadrotor in front or behind of Q, . In this 
case, a “safety breach” occurs. Our synthesis of the safety 
controller guarantees that between every pair of quadrotors 
Qi , Qk, as long as Vs(—t,Xi — Xk) > 0, 3u t to keep Qi from 
colliding with Qk for a desired time horizon (, despite the 
worst case (an adversarial) control from Qk- Therefore, as 
long as the number of “safety breaches” is at most one, Qi 
can simply use the optimal control u l to avoid collision with 
Qk for the time horizon of (. Since by assumption, vehicles 
in platoons are able to exit the current altitude range within 
a duration of (internal, if we choose t = (internal, the safety 
breach would always end before any collision can occur. 

Within a duration of (internal, there is a small chance that 
additional safety breaches may occur. However, as long as 
the total number of safety breaches does not exceed the 
number of affected quadrotors, collision avoidance of all 
the quadrotors can be guaranteed for the duration (internal- 
However, as our simulation results show, putting quadrotors 
in single-file platoons makes the likelihood of multiple safety 
breaches low during a quadrotor malfunction and during the 
presence of one intruder vehicle. 

In the event that multiple safety breaches occur for some 
of the quadrotors due to a malfunctioning quadrotor within 
the platoon or an intruding quadrotor outside of the platoon, 
those quadrotors with more than one safety breach still 
have the option of exiting the highway altitude range in 
order to avoid collisions. Every extra altitude range reduces 
the number of simultaneous safety breaches by 1, so K 
simultaneous safety breaches can be resolved using K — 1 
different altitude ranges. 

Given that quadrotors within a platoon are safe with 
respect to each other, each platoon can be treated as a single 
vehicle, and perform collision avoidance with other platoons. 
By treating each platoon as a single unit, we reduce the 
number of individual quadrotors that need to check for safety 
against each other, reducing overall computation burden. 

VI. Scenario Case Study 

In this section, we consider several situations that quadro¬ 
tors in a platoon on an air highway may commonly en¬ 
counter, and show via simulations the behaviors that emerge 
from the controllers we defined in Sections m and 0 

A. Forming a Platoon 

We first consider the scenario in which some quadrotors 
are trying to merge onto an initially unoccupied highway. In 
order to do this, each quadrotor first checks for safety with 
respect to the other quadrotors, and uses the safety controller 
if necessary, according to Section [V] Otherwise, the quadro¬ 
tor uses the liveness controller described in Section [TV] 

For the simulation example, the highway is specified by 
the line p y = 0.5 p x , the point of entry on the highway is 
chosen to be ( p x ,Py ) = (4,2), and the target velocity is 
such that the quadrotors travel at a speed v = 3 along the 


direction of the highway. This forms the target state Xp = 
(Px,Vx,Py,Vy), from which we define the target set Ch as 
in Section ITV-AI 

The first quadrotor that completes merging onto the empty 
highway creates a platoon and becomes its leader, while 
subsequent quadrotors form a platoon behind the leader in 
a pre-specified order according to the process described in 
Section IV-B Here, we choose (p Xjr ,p y , r ) to be a distance 
b behind the last quadrotor in the platoon, and {v x r , v yr ) = 
(0,0). This gives us the target set Cp. 

Figures [2] and [3] show the simulation results. Since the 
liveness reachable sets are in 4D and the safety reachable 
sets are in 6D, we compute and plot their 2D slices based 
on the quadrotors’ velocities and relative velocities. 

Figure [2] illustrates the use of liveness and safety reachable 
sets using just two quadrotors to reduce visual clutter. The 
first quadrotor Q\ (red disk) first travels in a straight line 
towards the highway merging point x (red circle) at ( = 1.5, 
because it is not yet in the liveness reachable set for merging 
onto the highway (red dotted boundary). When it is within 
the liveness reachable set boundary at ( = 2.8, it is “locked- 
in” to the target state x p, and follows the optimal control 
in ( fj~4l > to x 11 . During the entire time, Q\ checks whether 
it may collide with Q 2 within a time horizon of (external; we 

chose (external 3 > (internal- 

After Qi has reached x p, it forms a platoon, becomes the 
platoon leader, and continues to travel along the highway. 
Q 2 (blue disk), at ( = 7, begins joining the platoon behind 
Q i, by moving towards the target xp relative to the position 
of Q\. When Q 2 moves inside the liveness reachable set 
boundary for joining the platoon (blue dotted boundary), it 
is “locked-in” to the target relative state Xp, and begins 
following the optimal control in © towards the target 
whenever it is outside the safety reachable set (blue dashed 
boundary). 

Figure [3] shows the behavior of all 5 quadrotors which 
eventually form a platoon and travel along the highway 
together. The liveness controllers allow the quadrotors to 
optimally and smoothly enter the highway and join platoons, 
while the safety controllers prevent collisions from occurring. 


B. Malfunctioning Vehicle in Platoon 

We now consider a scenario where a quadrotor in a platoon 
of five malfunctions while the platoon is traveling along 
a highway. To best demonstrate the behavior of the other 
quadrotors in the platoon, this simulation assumes that Qp 3 , 
the middle quadrotor, malfunctions and reverses direction. 
When this happens, all of the other quadrotors in the platoon 
begin checking safety against it. In addition, Qp 3 is removed 
from the platoon, causing the other quadrotors to treat it as 
an intruder. Trailing quadrotors must leave the highway to 
avoid colliding with the faulty quadrotor. 

Figure [4] shows the platoon of quadrotors, Q,, i : 1,.... 5 
with Pi = i, traveling along the highway. At f = 0, Q 3 
malfunctions and begins to track the highway in reverse. 
Once Q 3 malfunctions, it is removed from the platoon 
and treated as an intruder. The platoon is then restructured 
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Fig. 4: Reachable sets used by trailing quadrotors to avoid 
colliding with the faulty quadrotor. 


Fig. 2: Reachable sets used to merge onto a highway to form 

a platoon (top subplots) and to join a platoon on the highway In this particular case, the safety breach is resolved even 


(bottom subplots). 


without any altitude change. 
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Fig. 3: Five quadrotors merging onto a highway. 


with the faulty quadrotor removed (()i\ = Qi+i for i = 
3,4). After avoiding Q 3 , the trailing quadrotors Q 4 and Q 5 
accelerate to reach their new platoon positions. ()\ and Qi 
are unaffected by the malfunctioning quadrotor. 

Figure [4] also shows the safe reachable set of Q 4 with 
respect to Q 3 (green dashed line), and the safe reachable set 
of Q 5 with respect to Q\ and Q 3 (purple dashed lines). 

At t = 1, Q 4 applies the safe controller to avoid entering 
the safe reachable set with respect to Q 3 . During Q 4 ’s 
avoidance maneuver, Q 5 simply follows Q 4 , and does not 
come across any safety breaches, as shown by the t = 1 
and t = 2.1 subplots. The safety breach ends soon after, 
and by t = 4.5, Q 4 begins merging back onto the highway, 
followed by Q 5 , in order to continue to follow the platoon. 


C. Intruder Vehicle 

We now consider the scenario in which a platoon of 
quadrotors encounters an intruder vehicle. To avoid collision, 
each quadrotor checks for safety with respect to the intruder 
and any quadrotor in front and behind in the platoon. 
If necessary, each quadrotor switches to using the safety 
controller. 

Figure [5] shows the simulation result. At t = 0, a platoon 
of 4 quadrotors, Qp^i = 1,..., 4 with Pi = i, travel along 
the highway. An intruder vehicle Q 0 (red disk) starts from 
position (40, 30) and heads toward bottom-left of the grid. 

The platoon leader Q />, ’s (black disk) safety is unaffected 
by the intruder. Followers Qp 2 (blue disk), Q/>. (green disk) 
and Qp 4 (pink disk), on the other hand, must use the safety 
controller in order to avoid collision with the intruder (t = 
3.3,6.2). This causes their paths to deviate off the highway. 
Once each quadrotor is safe relative to the intruder, they 
rejoin the original platoon (t = 12.4). Figure [ 6 ] illustrates 
the use of safety reachable sets in this scenario using only 
Qp 2 as an example. The safety reachable sets of Qp 2 with 
respect to the intruder Q 0 , Qp 1 and Q />, (red, black, green 
dashed lines) are shown. 

Initially, Qp 2 ( P 2 = 2) is a follower outside all 3 safety 
reachable sets. At t = 0.6, Q 2 comes to the boundary of the 
safety set with respect to the intruder and must apply the 
safety control law to avoid potential future collision. Thus 
it splits from the original platoon and becomes the leader 
of a new platoon consisting of itself, Q 3 and Q 4 . Q 2 keeps 
using the safety controller until it is safe with respect to the 
intruder again at t = 3. After t = 3, Qi is safe to use the 
liveness controller again to merge back onto the highway and 
join the original platoon. Note that during the entire time, Q 2 
maintains safety against the intruder, Q\ and (J 4 by always 
staying outside of all three safety reachable sets. 
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Fig. 5: Reaction of a platoon of 4 quadrotors on a highway 
to an intruder. 
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Fig. 6: Reachable sets used by quadrotor Q 2 to avoid 
collision with respect to the intruder and quadrotors Q \ and 
0,3 in front and behind it respectively. 


VII. Conclusions and Future Work 

We considered single-file platoons of UAVs modeled by 
hybrid systems traveling along air highways. Using HJ 
reachability, we proposed liveness controllers and built a 
safety controller around them to ensure no collision can 
occur from a single safety breach. Additional safety breaches 
can be handled by multiple altitude ranges in the airspace. 
Our simulations show that by putting vehicles into single-file 
platoons, the likelihood of having multiple safety breaches 
is low, and conflicts involving a single malfunctioning UAV 
or intruder can be resolved in a single altitude level. 
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